tor: premium tor-url / tor-irc / tor routes over Tor#8
Merged
Conversation
Add three premium-gated SSH routes:
ssh tor-url@host <url> one-shot HTTP(S) GET over Tor (host-side,
curl via SOCKS, 30s/2MB caps, http/https only)
ssh -t tor-irc@host <server> interactive IRC over Tor in the member's pod
ssh -t tor@host <command...> run any command over Tor (torsocks) in the pod
tor-url runs host-side and constrained; tor/tor-irc run inside the member's
isolated pod (new pods.Exec) so arbitrary/interactive commands are sandboxed,
never on the host. internal/tor wraps curl/torsocks/irssi. All gated by
ensurePremium; names reserved. setup.sh installs + enables tor (SOCKS
127.0.0.1:9050) and torsocks.
Note: tor-url is host-side and self-contained. tor/tor-irc still need the pod
image to carry torsocks+irssi and reach the Tor SOCKS — follow-up.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
vu1nz Security Review0 finding(s) in PR #? No security issues found. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds three premium-gated SSH routes that egress through Tor.
Commands
ssh tor-url@host <url>— one-shot HTTP(S) GET over Tor. Host-side, fully working & tested live ({"IsTor":true,...}via a Tor exit). Constrained: 30s timeout, 2MB cap, http/https only, curl over SOCKS (--socks5-hostname, no shell).ssh -t tor-irc@host <server[:port]>— interactive IRC over Tor (irssivia torsocks) inside the member's pod.ssh -t tor@host <command...>— run any command over Tor (torsocks) inside the member's pod.Design
tor-urlruns on the host (safe, capped).tor/tor-ircrun in the member's isolated pod via newpods.Exec, so arbitrary/interactive commands are sandboxed — never host shell.ensurePremium; route names reserved inauth.internal/torwraps curl/torsocks/irssi.setup.shinstalls + enablestor(SOCKS127.0.0.1:9050) andtorsocks.Verified
go build+go vetclean;tor-urltested live on the droplet (egress via Tor exit node confirmed; premium gate rejects non-premium).Remaining before merge
tor/tor-ircneed the pod image to carrytorsocks+irssiand reach the Tor SOCKS (pod→host Tor networking, or per-pod tor). Routes/handlers/gating are done; only the pod plumbing + a live test remain.🤖 Generated with Claude Code